Users should be able to pass file:// URLs to any of the
sub-commands. In 3be55ed6 the eval and fmt sub-commands were not
updated to accept file:// URLs for the input file and normal paths
(respectively).
This commit just moves the unexported cleanFileURL function from the
loader package into it's own internal package so that it can be shared
in OPA.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Recently added changes switched to using prepared queries, and on
error would just return/exit. We needed to capture the error and
send it through the result formatter.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The new `-b`/`--bundle` CLI options will accept a directory to be
loaded as a bundle, or a file which will be loaded as a tarball.
Closes: #1584
Signed-off-by: Patrick East <east.patrick@gmail.com>
The file loader splits paths on the first colon character and uses the
left-hand side for the prefix to root the document at under data. On
windows this is problematic because of drive lettesr (e.g., C:\X\Y\Z
is interpreted as load file at \X\Y\Z under data.C.
This change updates the loader to accept file:// URLs. This way
callers can unambiguously specify filenames that contain colon
characters. For now this will mainly be used by VS Code and other
programmatic callers. In future we can support other schemes (e.g., http).
Fixes#1505
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This change updates the test command to use the fail explanation mode
by default. Since the test framework expects test rules to be
defined/true failure events are usually what is required to debug test
failures (e.g., some assertion in the test rule will Fail and that
will _likely_ be based on some failure in the policy under test.)
Hopefully this makes the test output a bit less verbose and more readable.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes just add another option to the API to supply parsed
modules directly. This allows tools that rely on the file loader to
skip parsing of modules for a second time when running evaluation. For
large sets of modules this can reduce latency quite a bit.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
It was getting parsed from string -> ast.Term but the generated
parser is (apparently) not as performant as the json parser and then
using `ast.InterfaceToValue`.
Fixes: #1488
Signed-off-by: Patrick East <east.patrick@gmail.com>
These changes add a new parameter to partial eval to disable inlining
on virtual documents. This allows callers with knowledge of the policy
to reduce the cost of partial eval (at the expense of receiving
support rules.) In the future, OPA can be extended to automatically
disable inlining using the new parameter.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The eval subcommand currently supports a --fail flag that causes the
subcommand to exit with a non-zero status when the query result is
undefined. While this is useful in some cases, runners often want to
see an error message explaining _why_ the exit status is
non-zero. Since the query result is undefined, policy authors can't
surface information in the result set
With these changes, the eval subcommand includes a new --fail-defined
flag has the opposite behaviour: exit with non-zero status if the
query result is defined/non-empty. This works well for deny lists that
are commonly found in admission use cases.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously coverage was only available via the test runner. This
allows callers to run ad-hoc queries and see what parts of the policy
are evaluated.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
For the time being, enabling profiling will disable tracing and vice versa. Once we add support for multiple tracers, this behavior can be changed.
Fixes#838
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Signed-off-by: repenno <rapenno@gmail.com>
* Add support for non-zero exit code
Adds support for non-zero exit code when providing the --fail flag to
the eval command. 0 means no error, 1 means undefined result and 2 means
an error.
Fixes#981
Signed-off-by: Kim Christensen <kimworking@gmail.com>
These changes add support for accessing runtime information inside of
policies. In some cases, policies need to access environment variables
or configuration that OPA was booted with. These changes add a built-in
function that allows policies to gain access to this information. The
built-in function itself is relatively trivial. Most of the required
changes were plumbing the runtime information from the entrypoint down
into the evaluation engine. The alternative would have been to introduce
a global variable containing this information however that would be have
been harder to reason about in library integrations.
Fixes#420
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the eval subcommand to support partial evaluation.
As part of these changes, the pretty formatting of partial evaluation
results has been refactored and moved into the presentation package. The
new version uses the tablewriter like other output values.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Instead of checking flags in the main business logic, just default
.profile and .metrics in the pre-run.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, output was being printed in the presentation package, REPL,
and eval subcommand. Thes changes refactor the presentation package so
that it can handle all of the output printing required by the REPL and
the eval subcommand.
These changes affect the 'json' output format in the REPL. Previously,
the JSON output format would display either the expression value or
bindings. With these changes, the 'json' output format in the REPL is
the same as the one in the eval subcommand.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
I don't know why I ended up looking into this, but I've run
golangci-lint run --disable-all -E deadcode
on the code base and removed everything that came up :)
Signed-off-by: Stephan Renatus <srenatus@chef.io>
These output formats are handy for using Rego to extract values from
JSON documents on the command line.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
In some cases, it's more convenient to pass input via stdin than using
a path or process substitution.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the subcommands to support a file/directory name
filter. This allows users to exclude certain files from being loaded.
With these changes users can excldue private directories created by
Kubernetes for volume-mounted ConfigMaps.
As part of this change, update the Kubernetes deployment documentation
to use the new --ignore flag, run OPA as a Deployment instead of as a
ReplicationController, and generally improve the example.
Fixes#782
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This allows the specification of multiple data/policy files, mirroring
the old behaviour of the run command's eval flag.
Resolves#713.
Signed-off-by: Brendan Devenney <brendan.devenney@cloudreach.com>
Torin Sandall